733 matches found
PT-2022-10808
Name of the Vulnerable Software and Affected Versions IBM System Storage DS8000 Management Console HMC versions 88.5x.x.x through 89.2x.0.0 Description The issue allows a remote attacker to obtain sensitive information through unpublished URLs. Recommendations For versions 88.5x.x.x through...
IBM System Storage DS8000 Hardware Management Console 安全漏洞
IBM System Storage DS8000 Hardware Management Console is a hardware management console for the DS8000, an IBM storage media platform from IBM, U.S.A. The IBM System Storage DS8000 Hardware Management Console An information disclosure vulnerability exists, which stems from a network system or...
PT-2022-10806
Name of the Vulnerable Software and Affected Versions IBM System Storage DS8000 Management Console HMC versions 88.5x.x.x through 89.2x.0.0 Description The issue allows a remote attacker to obtain sensitive information through unpublished URLs. Recommendations For versions 88.5x.x.x through...
CVE-2021-38930
IBM System Storage DS8000 Management Console HMC R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210331...
CVE-2021-38929
IBM System Storage DS8000 Management Console HMC R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210330...
Business Logic Errors
Description Product status of product is unpublished has been deleted by admin in Trash folder but user can still add to cart and make purchases Proof of Concept Step 1: Admin go to Shop Products: Unpublish product and Delete product Step 2: User add product to cart by request POST...
WordPress plugin Jetpack Carousel module of the JetPack 安全漏洞
WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. redirection is a redirection management plugin used in it. jetpack is a WordPress website security management tool used in i...
Denial of Service (DoS)
Overview node-static is a rfc 2616 compliant HTTP static-file server module, with built-in caching. Affected versions of this package are vulnerable to Denial of Service DoS. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%...
Design/Logic Flaw
An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of commodules leak names of unpublished and/or inaccessible modules...
CVE-2021-23123
An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of commodules leak names of unpublished and/or inaccessible modules...
PT-2021-15378 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.23 Description: The issue is related to the lack of ACL checks in the "orderPosition endpoint" of com modules, which can leak names of unpublished and/or inaccessible modules. Recommendations: For Joomla!...
spalni-sofiia.plastmasovi.com Cross Site Scripting vulnerability OBB-1419350
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
...
GHSA-33GC-F8V9-V8HM Malicious Package in ladder-text-js
ladder-text-js contained a malicious script that attempted to delete all files when npm test was run. Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it...
Silently Runs Cryptocoin Miner in hooka-tools
Affected versions of hooka-tools were compromised and modified to silently run a cryptocoin miner in the background. All affected versions have been unpublished from the npm registry. Recommendation While this module has been unpublished, some versions may exist in mirrors or caches. Do not insta...
DRUPAL-CONTRIB-2020-032
The Group module enables you to hand out permissions on a smaller subset, section or community of your website. With the 1.1 security release, new code was introduced to ensure proper access for all entity types, but a mistake introduced unexpected access to unpublished nodes...
PT-2020-23069
The Group module enables you to hand out permissions on a smaller subset, section or community of your website. With the 1.1 security release, new code was introduced to ensure proper access for all entity types, but a mistake introduced unexpected access to unpublished nodes...
Group - Moderately critical - Information disclosure - SA-CONTRIB-2020-032
The Group module enables you to hand out permissions on a smaller subset, section or community of your website. With the 1.1 security release, new code was introduced to ensure proper access for all entity types, but a mistake introduced unexpected access to unpublished nodes...
Shopify: Script Editor preview token still working with uninstalled application, even for unpublished script
Within the Script Editor application, it is possible to preview a script on the storefront and proceed to purchase. Once the user click on the preview link, it opens https://shop.myshopify.com/admin/scripts/preview?scriptid=scriptid which then generate a preview token to be used by the storefront...
DRUPAL-CONTRIB-2020-018
This webform module enables you to build a 'Term checkboxes' element. The module doesn't sufficiently check term 'view' access when rendering 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term checkboxes' element...